Dockerfile

# ── Stage 1: builder ──────────────────────────────────────────────────────────
FROM python:3.11-slim@sha256:9a7765b36773a37061455b332f18e265e7f58f6fea9c419a550d2a8b0e9db834 AS builder

WORKDIR /app

COPY requirements.txt requirements-cv.txt ./
RUN python -m venv /opt/venv && \
    /opt/venv/bin/pip install --no-cache-dir pip==26.1.1 setuptools==81.0.0 wheel==0.47.0 && \
    /opt/venv/bin/pip install --no-cache-dir \
        torch==2.12.0+cpu \
        torchvision==0.27.0+cpu \
        --index-url https://download.pytorch.org/whl/cpu && \
    /opt/venv/bin/pip install --no-cache-dir -r requirements.txt -r requirements-cv.txt && \
    # Remove all build and package tools from venv after installation to minimize attack surface
    /opt/venv/bin/pip uninstall -y setuptools wheel pip

COPY src/ src/
COPY scripts/ scripts/

# Download YOLO model (not in repo — gitignored)
# Pinned to commit 3b6d6174773d774f834f92b5770bd14355f2cb14 for reproducibility
# SHA-256: 53c6c7b0f4936621e47f1e7c582044b6f25a02dbb9431f13906885a96159c50f
RUN apt-get update && apt-get install -y --no-install-recommends curl \
  && rm -rf /var/lib/apt/lists/* \
  && mkdir -p models \
  && curl -fsSL -o models/yolov8s-pokemon.pt \
       "https://huggingface.co/keremberke/yolov8s-pokemon-classification/resolve/3b6d6174773d774f834f92b5770bd14355f2cb14/best.pt" \
  && echo "53c6c7b0f4936621e47f1e7c582044b6f25a02dbb9431f13906885a96159c50f  models/yolov8s-pokemon.pt" | sha256sum -c -

RUN PYTHONPATH=src /opt/venv/bin/python scripts/seed_db.py

# ── Stage 2: runtime ──────────────────────────────────────────────────────────
FROM python:3.11-slim@sha256:9a7765b36773a37061455b332f18e265e7f58f6fea9c419a550d2a8b0e9db834 AS runtime

WORKDIR /app

# Consolidate OS package installation and security patching.
# Pinned versions are tied to the current base image digest and should be updated
# if the @sha256 pin is changed.
RUN apt-get update && apt-get install -y --no-install-recommends \
    libgl1 libglib2.0-0 \
    libcap2 libsystemd0 libudev1 \
  && apt-get install -y --only-upgrade \
    libc6=2.41-12+deb13u3 \
    libc-bin=2.41-12+deb13u3 \
    sed=4.9-2+deb13u1 \
  && (python -m pip uninstall -y setuptools wheel pip 2>/dev/null || true) \
  && useradd -m appuser \
  && rm -rf /var/lib/apt/lists/*

# Copy venv and app from builder (--chown avoids a separate chown layer)
COPY --from=builder /opt/venv /opt/venv
COPY --from=builder --chown=appuser:appuser /app/src ./src
COPY --from=builder --chown=appuser:appuser /app/pokemon.db ./pokemon.db
COPY --from=builder --chown=appuser:appuser /app/models ./models

USER appuser

ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONPATH=src

EXPOSE 8000

# Note: CMD will still work as uvicorn and app dependencies are already installed in /opt/venv
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]